The vulnerability resides in the HTTP POST Request Handler at /viva/update.php of the Cyber-III Student-Management-System. Manipulating the Name argument bypasses authorization checks, allowing an attacker to modify or potentially create entries without proper privileges. The resulting unauthorized actions can compromise data integrity and confidentiality of student records. The weakness is classified as improper authorization (CWE-266) and insecure credential management (CWE-285).

The affected product is Cyber‑III Student‑Management‑System, with the vulnerability present up to the commit 1a938fa61e9f735078e9b291d2e6215b4942af3f. Because the project uses a rolling release model, no specific version numbers are available, meaning all iterations before a patch remain vulnerable.

The CVSS score of 6.9 indicates a moderate severity, and the exploit has been publicly disclosed, making it likely that attackers can employ known techniques. EPSS data is not provided, and the vulnerability is not listed in the CISA KEV catalog, but the lack of an authorization guard and the remote nature of the attack vector via HTTP POST raise the risk of exploitation. In practice, an attacker controlling the Name parameter can trigger the bug from any network position that can reach the application.